Skip to content

Insecure deserialization in Jato Framework #372

New issue
New issue
Closed
Closed
Insecure deserialization in Jato Framework#372
Assignees
vharseko

Description

@artsploit
artsploit
opened on Jun 15, 2021

Describe the bug
Jato framework contains a critical vulnerability due to deserialization of untrusted data in jato.pageSession parameter.

Vulnerable source code

com/iplanet/jato/view/ViewBeanBase.class:

protected void deserializePageAttributes() {
   if (!this.isPageSessionDeserialized()) {
       ...

       String pageAttributesParam = context.getRequest().getParameter("jato.pageSession");
       if (pageAttributesParam != null && pageAttributesParam.trim().length() > 0) {
           try {
               this.setPageSessionAttributes((Map)Encoder.deserialize(Encoder.decodeHttp64(pageAttributesParam), false));
           } catch (Exception var4) {

The Encoder.deserialize internally uses ObjectInputStream.readObject without a whitelist, which may lead to remote code execution in the worst case.

OpenAm contains multiple endpoints where Jato pages are exposed without authentication.

To Reproduce
The details of this vulnerability are deliberately omitted due to severity of the report. Please contact me at artsploit@gmail.com if you need more details.

Activity

  1. artsploit commented on Jun 15, 2021

    @artsploit
    artsploit
    on Jun 15, 2021
    Author

    just some ideas how this can be mitigated:

    1. Deprecate and do not use Jato at all. ForgeRock Am went this way.
    2. Introduce a whitelist of classes that can be deserialized (similar to

      OpenAM/openam-shared/src/main/java/org/forgerock/openam/utils/IOUtils.java

      Line 273 in da05a2f

      private static class WhitelistObjectInputStream extends ObjectInputStream {
      , but requires patching Jato code)
    3. Sign jato.pageSession with a cryptographic key to avoid tampering on the client side (also requires patching Jato).
    4. Reject any request that contains "jato.pageSession" parameter. Easier to implement, but may break some legacy functionality.
  2. vharseko
    self-assigned this
    on Jun 15, 2021
  3. maximthomas
    added a commit that references this issue on Jun 30, 2021

    #372 issue workaround

    4a4f305
  4. vharseko
    added a commit that references this issue on Jun 30, 2021

    #372 Remote Code Execution (CVE-2021-35464) workaround

    a267913
  5. vharseko
    closed this as completedon Jun 30, 2021
  6. vharseko
    added a commit that references this issue on Oct 21, 2026

    CVE-2026-111758 CVE-2026-111766 markdown-it: Quadratic-time DoS in mu…

    b35e90c
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions